Its easy, index=blah counter=% processor time| eval CPU_Usage=value|join host[search index=blah counter=% available mbytes|eval Mem_Usage=value]| table host,CPU_Usage,Mem_Usage| where Condition|eval Status=if(CPU_Usage>50 AND Mem_Usage>(any value),"Warning","Critical") Same goes for the above question. ... View more

Did you check your lookup definition? Does this moname field exists in the lookup table? if not you have to specify the field in the lookup table as moname. It's most probably the problem with lookup definition. Tweak a bit it will work. ... View more

From where the $hostname$ is being passed? i think some module is not properly closed where it should be to pass that variable value from some pulldown/text module for the search to find. Kindly explain my first concern. Thanks ... View more

Hello Ravi, if you have your appname extracted then, host="*" source="/home/abc/tomcat/logs/localhost_access_log.txt"|timechart count(application) by _time should work for you on dashboard. _time can replaced according to your requirement by other date fields. Make a query and see on search app if its giving you the desired result or you may need to tweak a bit. ... View more

Please see the Splunk UI fiels-> field extraction. Choose the field. Change the names according to your requirement. Or you can also modify them in props.conf and restart to get them worked. Hope it helps. Thanks ... View more

module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="name" autoRun="True"> None Saved Search Name results 10 Try using this, this is tested and working. You don't need module name="GenericHeader" to make the Hiddensavedsearch work. ... View more

Isn't it easy to just apply where condition server_load>80 in your search query? Am i not getting something!! Kindly explain. ... View more

Forward the data via a WMI query to splunk , define that in wmi.conf where you mention the query and interval to check the services. From the index you can take out the service name and status of the service. When its stopped it will alert you. It should be an realtime alert or an alert which rolls over a timeperiod. Thanks ... View more

Yes it should do the logout from splunk side as well what i can think of, because we are cancelling the current sessionid. I am not sure of it fully but, as Splunk suggests you can end an session forcibly through REST ,your question may be correct. Please see the document for more clarity: http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkSSO ... View more

Agreed, edited my comment ... View more

Yes Chayya, it's possible. But you need to mention a common field data for both the lookup table and output data from query. Further you need to mention the lookup definition as |inputlookup will not work in the middle of the query. You will definitely get the output if the data matches the lookup table data, your case will workout very well. ... View more

Hello Yoho, As splunk documentation mentions about session management in SSO the user session will not be over by default. Session management: Since there is no simple log out for a session and Splunk will preserve a session as long as the correct header information is contained in the proxy header, you should set your proxy's session timeout value with this in mind. Keep in mind it will not redirect you to login page OR if it does you not be able to use any credential as it's SSO , you are already authenticated through LDAP. If you have any problem with the web, Just close the browser and re-open. Splunk will create a new session if there isn't one existing for the same IP/USER. Thanks, hope it helps. ... View more

Hello, You can directly migrate to newer version without uninstalling the forwarder. Below link will help you do it with the help of scripts: http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/MigrateaWindowsforwarder http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/DeployaWindowsdfviathecommandline Hope it will help!!! ... View more

It means the file name is wrong in the transforms.conf or the file is locked by some other process or splunk doesn't have read access to the location. try these options should resolve the issue. And i thought the lookup files should be inside the \etc\apps\app_name\lookups folder, Isn't it? ... View more

Nope, you can search using where clause and then make a table for a better view of result. You can also place your keyword in while mentioning the search , which will give you the result where the words are found in the result. e.g. index= N sourcetype=S "Keyword"|Table Fields.. OR index= N sourcetype=S | where field like "%%Keyword%%"|Table Fields.. ... View more

Splunk doesn't get the event times from the logs. You have to specify the time format explicitly to get the timing. In props.conf TIME_FORMAT= Log_time format e.g. y%:m%:d% TIME_PREFIX=regex to get the time filed MAX_TIMESTAMP_LOOKAHEAD= Specify the size of the time fields to look at These are the most useful field to get it resolved. New index data will show the update but the old data stat as it is. ... View more

Agreed, moreover splunk wont be able to install two instances i suppose ... View more

It may work for today, yesterday but how do i make a trend chart for a month? I will always need the floor value of the date to my earliest parameter. Let me know if any new idea hits. I need to dig deep. ... View more

Thanks for the reply, but i can't make the values hard coded as the values will change according to the value changed by the TimeRangePicker module ... View more

Hello edonza, Please use <![CDATA to get any special characters in your XML or use amp; instead of & in xmls as they will give error and the views wont load. ... View more

It depends what is your requirements are like! If your threshold values are varying with time, create a lookup / using eval statement find the exact threshold value for that Hour. I will give an example eval threshold=case(date_hour =9 threshold, "3", date_hour =11, "5")|eval State=case(value <= threshold, "Normal", value >= threshold*1.2, "warning", value >= threshold*1.5, "Critical")|Table State then as i mentioned above replace the codes and place a image with relevant color to appserver/static/images folder. it will do the job what you want ... View more

Do you want them it to be in single panel / single dashboard page? ... View more

if you do a simple view on a dashboard, you will be able to use "simpleresultstable" module for displaying your eval field value. So i am not sure which i should explain? The .js file will replace the value with image on the go. ... View more